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MEMORANDUM  FOR  DIRECTOR,  DEFENSE  FINANCE  AND  ACCOUNTING 

SERVICE 

SUBJECT:  Audit  Report  on  Year  2000  Posture  of  Mid-Tier  Computer  Systems 
Processing  Defense  Finance  and  Accounting  Service  Data 
(Report  No.  99-227) 


We  are  providing  this  audit  report  for  information  and  use.  This  report  is  one  in  a 
series  of  reports  that  the  Inspector  General,  DoD,  is  issuing  in  accordance  with  an 
informal  partnership  with  the  DoD  Chief  Information  Officer  to  monitor  the  Defense 
Finance  and  Accounting  Service  efforts  in  addressing  the  year  2000  computing  challenge. 
We  considered  management  comments  on  a  draft  of  this  report  when  preparing  the  final 
report. 


The  Defense  Finance  and  Accounting  Service  comments  conformed  to  the 
requirements  of  DoD  Directive  7650.3;  therefore,  additional  comments  are  not  required. 

We  appreciate  the  courtesies  extended  to  the  audit  staff.  Questions  on  the  audit 
should  be  directed  to  Ms.  Kimberley  A.  Caprio  at  (703)  604-9139  (DSN  664-9139) 
(kcaprio@dodig.osd.mil)  or  Mr.  Dennis  L.  Conway  at  (703)  604-9158  (DSN  664-9158) 
(dconway@dodig.osd.mil).  See  Appendix  F  for  the  report  distribution.  The  audit  team 
members  are  listed  inside  the  back  cover. 


Robert  J.  Lieberman 
Assistant  Inspector  General 
for  Auditing 


Office  of  the  Inspector  General,  DoD 


Report  No.  99-227  July  29, 1999 

(Project  No.  9FG-9009) 


Year  2000  Posture  of  Mid-Tier  Computer  Systems 
Processing  Defense  Finance  and  Accounting  Service  Data 


Executive  Summary 


Introduction.  This  report  is  one  in  a  series  of  reports  that  the  Inspector  General,  DoD,  is 
issuing  in  accordance  with  an  informal  partnership  with  the  DoD  Chief  Information 
Officer  to  monitor  DoD  efforts  in  addressing  the  year  2000  computing  challenge.  The 
prior  reports  issued  by  the  Inspector  General,  DoD,  are  listed  in  Appendix  B. 

Objectives.  The  overall  audit  objective  was  to  assess  whether  multi-user,  medium-sized 
computers  (mid-tier  computers)  processing  Defense  Finance  and  Accounting  Service 
(DFAS)  data  would  operate  properly  after  December  31, 1999.  Specifically,  we 
evaluated  efforts  taken  through  March  1999  to  ensure  that  mid-tier  computer  systems  and 
their  software  were  Year  2000  compliant. 

Results.  DFAS  managers  were  aware  of  and  actively  involved  in  achieving  compliance 
with  the  DoD  Year  2000  Management  Plan.  However,  as  of  March  1999,  DFAS  could 
not  be  fully  assured  that  mid-tier  computer  systems  would  be  Year  2000  compliant 
because  of  the  following: 

•  the  inventory  was  not  updated  for  mid-tier  computer  systems, 

•  test  plans  were  not  always  detailed  or  the  results  of  testing  documented  for 
mid-tier  computer  systems, 

•  managers  and  users  of  systems  that  interface  with  DFAS  mid-tier  computer 
systems  needed  to  be  more  involved  in  contingency  planning,  and 

•  five  systems  were  not  yet  certified  as  being  tested  on  Year  2000  compliant 
mid-tier  computers. 

For  details  of  the  audit  results,  see  the  Finding  section  of  the  report. 

Summary  of  Recommendations.  We  recommended  that  DFAS  periodically  reconcile 
and  update  its  inventory  of  mid-tier  computer  systems,  develop  Year  2000  test  plans  for 
mid-tier  computer  systems  to  include  systems’  interfaces,  and  certify  that  mid-tier 
computer  systems  are  tested  on  Year  2000  compliant  mid-tier  computers. 

Management  Action  and  Comments.  The  DFAS  Director,  Information  and 
Technology  concurred  with  reconciling  and  updating  the  inventory  of  mid-tier  computer 
systems  and  certifying  those  systems  for  Year  2000  compliance.  He  provided 
information  indicating  further  DFAS  progress  through  early  June  1999.  All  of  the 
systems  reviewed  during  the  audit  are  now  certified.  The  Director  partially  concurred 
with  developing  test  plans  and  nonconcurred  with  including  cost  estimates  in  contingency 
plans.  A  discussion  of  management  comments  is  in  the  Finding  section  of  the  report,  and 
the  complete  text  is  in  the  Management  Comments  section. 


Audit  Response.  The  DFAS  comments  were  responsive.  We  agree  with  DFAS  that,  if 
all  of  the  systems  operating  on  mid-tier  computer  systems  have  been  tested  and  certified, 
standardizing  the  testing  procedures  is  no  longer  feasible.  The  portion  of  the 
recommendation  related  to  standardized  procedures  has  been  deleted.  Further,  based  on 
the  fact  that  the  DoD  Y2K  office  told  DFAS  that  the  DoD  Y2K  Management  Plan 
requirement  to  identify  costs  for  “each”  potential  contingency  was  not  practical  (because 
of  the  vast  number  of  potential  contingencies  that  could  occur  and  because  it  is  too  late  in 
the  fiscal  year  to  program  additional  fiinds  for  the  high  risk  contingencies),  the  related 
recommendation  has  also  been  revised.  We  agree  that  DFAS  has  a  fundamentally  sound 
approach  for  minimizing  Y2K  risk  to  operations  that  depend  on  mid-tier  computer  system 
and  platforms.  No  further  management  comments  are  required. 
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Background 

The  Year  2000  Problem.  Computer  systems  have  typically  been  designed  to  use 
only  the  last  two  digits  for  the  year;  thus,  the  year  2000  (Y2K)  is  indistinguishable 
from  1900.  As  a  consequence,  computers  and  associated  software  that  use  dates 
to  calculate,  compare,  and  sort  data  could  generate  incorrect  results  when  working 
with  years  after  1999.  The  potential  for  computer  system  failure  after  the  year 
1999  is  often  referred  to  as  the  Y2K  problem. 

Classifications  of  DoD  Computer  Systems.  Depending  on  physical  size, 
computing  speed,  and  processing  capabilities,  DoD  computer  systems  are 
generally  classified  into  three  categories:  mainframe,  mid-tier,  and  personal 
computer  systems. 

•  Mainframe  computers  are  considered  the  largest  and  most  powerful 
category  of  general-purpose  computers.  Mainframes  are  typically 
housed  in  a  specialized  environment  that  provides  for  specific 
temperature,  humidity,  and  electrical  power  requirements.  Mainframes 
can  process  several  applications  at  a  time  and  can  simultaneously 
support  hundreds  of  users.  The  Defense  Information  Systems  Agency 
(DISA)  owns  many  mainframe  computers  and  operates  them  within 
facilities  called  megacenters. 

•  Mid-tier  computers  are  often  called  mini-computers  and  are  less 
powerful  than  mainframes.  Mid-tier  computers  have  many  of  the 
operational  characteristics  and  capabilities  of  mainframe  computers. 
Unlike  mainframes,  mid-tiers  do  not  require  a  specialized  environment 
and  are  commonly  operated  in  a  typical  business  office  setting.  As  of 
March  1, 1999,  the  Defense  Finance  and  Accounting  Service  (DFAS) 
reported  that  it  had  33  systems  using  mid-tier  computers. 

•  Micro  computers  (personal  computers)  are  lower  in  price  and 
performance  than  mainframe  or  mid-tier  computers.  By  adding  a 
modem  and  communications  software,  a  micro  computer  can  also  serve 
as  an  interface  with  other  computers. 

Appendix  C  provides  technical  or  uncommon  computer-related  terms  used  in  this 
report. 

Implementation  of  Y2K  Corrective  Actions.  The  Office  of  Management  and 
Budget  established  a  target  date  of  March  31, 1999,  for  implementing  all  Y2K 
corrective  actions  in  all  systems.  The  guidance  was  issued  in  a  January  1998 
memorandum  for  the  heads  of  executive  departments  and  agencies.  In  June  1998, 
the  Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and 
Intelligence),  who  is  also  the  DoD  Chief  Information  Officer,  revised  the  target 
implementation  date  for  all  DoD  mission-critical  computer  systems  to 
December  31,  1998. 
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DFAS  Y2K  Strategy.  DFAS  made  the  Y2K  problem  its  highest  information 
management  priority.  The  overall  goal  for  DFAS  was  to  provide  an  organization- 
wide,  coordinated  effort  that  ensures  that  no  system  is  adversely  affected  by  Y2K 
problems. 

During  our  review,  DFAS  was  using  guidance  in  the  “Defense  Finance  and 
Accounting  Service  Year  2000  Management  Plan,”  December  1997,  version  1.0, 
and  the  “DoD  Year  2000  Management  Plan,”  version  2.0,  December  1998. 


Objectives 


The  overall  audit  objective  was  to  assess  whether  multi-user,  medium-sized 
computers  (mid-tier  computers)  processing  DFAS  data  would  operate  properly 
after  December  3 1 , 1999.  We  evaluated  efforts  taken  to  ensure  that  mid-tier 
computer  systems  and  their  software  were  Y2K  compliant.  See  Appendix  A  for  a 
discussion  of  the  audit  scope  and  methodology  and  Appendix  B  for  a  summary  of 
prior  audit  coverage. 
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Year  2000  Posture  of  Mid-Tier  Computer 
Systems  Processing  Defense  Finance  and 
Accounting  Service  Data 

DFAS  could  not  be  fully  assured  that  mid-tier  computer  systems 
processing  DFAS  data  would  be  Y2K  compliant  because: 

•  the  inventory  of  mid-tier  computer  systems  needed  to  be  fully 
reconciled  and  updated; 

•  test  plans  needed  to  be  developed  and  results  of  testing 
documented  for  mid-tier  computer  systems; 

•  contingency  plans  needed  to  be  revised  to  incorporate  cost 
estimates  for  mid-tier  computer  systems;  and 

•  mid-tier  computer  systems  needed  to  be  certified  as  being 
tested  on  Y2K  compliant  mid-tier  computers. 

As  a  result,  DFAS  needed  additional  effort  to  mitigate  risk  that  its  mid-tier 
computer  systems  would  not  successfully  process  Y2K-related  data. 


DoD  Plans  to  Reduce  Risks  of  Y2K  Failure 

Plans  for  Addressing  Y2K  Deficiencies.  The  “DoD  Year  2000  Management 
Plan,”  version  2.0,  December  1998,  requires  DoD  organizations  to  use  the  process 
that  the  Office  of  Management  and  Budget  directed  to  minimize  the  risks  of 
systems  failing  in  Y2K.  DFAS  issued  version  2.0  of  its  management  plan,  in 
May  1999,  which  focused  on  ensuring  that  no  DFAS  systems  fail  because  of  Y2K 
problems.  The  DFAS  plan  addressed  the  following: 

•  promoting  Y2K  awareness  across  the  entire  organization; 

•  inventorying  all  systems  and  assessing  problems; 

•  replacing,  repairing,  or  terminating  systems  to  ensure  Y2K 
compliance; 

•  testing  and  certifying  systems  for  Y2K  compliance;  and 

•  deploying  renovated  and  replacement  systems. 

Reviews  on  DFAS  Progress  in  Reducing  Potential  Y2K  Deficiencies.  This 
audit  assessed  the  actions  that  DFAS  took  through  March  1999  to  reduce  the 
potential  Y2K  deficiencies  of  systems  operating  on  mid-tier  computer  systems. 
We  reviewed  17  of  33  systems  operating  on  mid-tier  computers  (7  of  the  17 
systems  were  classified  by  DFAS  as  mission-critical).  Appendix  D  provides  a 
description  of  each  system  reviewed. 
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DFAS  Progress  in  Managing  Y2K  Problems 


DFAS  managers  were  actively  pursuing  compliance  with  the  DoD  Y2K 
Management  Plan.  However,  DFAS  needed  to  reduce  the  risks  of  system  failure 
in  Y2K  by  taking  additional  actions  with  regard  to  mid-tier  computer  systems. 
Those  actions  included  the  following: 

•  reconciling  and  updating,  with  DISA,  the  inventory  of  systems  using 
mid-tier  computers; 

•  developing  more  detailed  test  plans  and  documenting  results  of  testing 
for  mid-tier  computer  systems; 

•  involving  managers  and  users  of  systems  interfacing  with  DFAS 
systems  in  contingency  planning;  and 

•  ensuring  that  systems  using  mid-tier  computers  were  certified  as  having 
been  tested  on  Y2K-compliant  mid-tier  computers. 

Reconciling  and  Updating  the  Inventory  of  Systems.  DFAS  and  DISA  had  not 
fully  reconciled  and  updated  the  inventory  of  mid-tier  computer  systems.  A 
complete  inventory  would  provide  greater  assurance  that  all  systems  operating  on 
mid-tier  computers  have  been  identified  and  considered  for  Y2K  compliance. 

The  DFAS  Y2K  Management  Plan  states  that  an  inventory  of  DFAS  systems  will 
be  developed  to  facilitate  performing  Y2K  assessments.  We  requested  that  DFAS 
provide  an  inventory  of  its  mid-tier  computer  systems  and,  as  of  November  24, 
1998,  DFAS  provided  a  list  of  19  systems.  However,  as  of  March  1, 1999,  DFAS 
had  changed  its  inventory  to  33  mid-tier  computer  systems,  to  include  systems 
under  development.  The  33  systems  resulted  from  DFAS  adjusting  its  inventory 
by  removing  10  systems  and  adding  24  systems. 

Because  of  the  significant  adjustments,  we  attempted  to  verify  the  accuracy  of  the 
DFAS  inventory.  We  obtained  an  inventory,  as  of  March  1, 1999,  of  DFAS 
systems  from  DISA.  The  DISA  inventory  included  six  DFAS  mid-tier  computer 
systems  that  were  not  recorded  on  the  DFAS  inventory.  In  addition,  we  identified 
two  DFAS  mid-tier  computer  systems  that  were  not  on  either  the  DFAS  or  DISA 
inventories.  The  two  systems  were  a  part  of  six  systems  reviewed  in  this  audit 
that  processed  data  on  mid-tier  computer  systems  interfacing  with  the 
Mechanization  of  Contract  Administration  Services  system.  (The  DFAS 
inventory  contained  four  of  the  six  systems,  and  the  DISA  inventory  identified 
two  of  the  six  systems.) 

Both  DFAS  and  DISA  need  to  reconcile  and  update  their  inventories  periodically. 
Updating  the  inventories  will  provide  greater  assurance  that  all  DFAS  mid-tier 


1  The  six  DFAS  systems  that  interfaced  with  the  Mechanization  of  Contract  Administration  Services 
system  were  the  Prevalidation  Management  Information  Reporting  System,  the  Contractor  Invoice 
Service,  the  Contract  Reconciliation  System,  the  Entitlement  Automation  System,  the  Electronic 
Document  Management  System,  and  the  Unmatched  Disbursement  Reconciliation  System. 
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computer  systems  are  identified  for  Y2K  reporting  and  compliance  with  the  DoD 
Y2K  Management  Plan.  The  table  in  Appendix  E  shows  the  inventories  of  DFAS 
mid-tier  computer  systems  as  of  March  1,  1999. 

Plans  for  Testing  DFAS  Systems  Using  Mid-Tier  Computers.  DFAS  had  not 
developed  adequate  plans  for  conducting  “systems-level”  testing  on  7  of  17 
mid-tier  computer  systems2.  For  those  systems,  DFAS  system  managers  had  not 
prepared  detailed  test  plans  that  included  the  identification  of  system  interfaces, 
testing  of  remote  sites,  or  specific  test  conditions. 

One  of  the  objectives  in  the  DoD  Y2K  Management  Plan  is  to  ensure  that  testing 
is  conducted  to  validate  that  systems  are  Y2K  compliant  and  perform  as  intended. 
The  extent  of  Y2K  testing  and  documentation  of  the  test  plans  and  test  results 
varied  for  the  17  systems  reviewed.  For  example,  some  system  managers  worked 
with  users  and  conducted  tests  on  the  users’  systems,  while  other  system 
managers  used  only  tests  conducted  by  programmers  to  ensure  that  a  system  was 
Y2K  compliant. 

For  example,  the  Defense  Business  Management  System  was  identified  as  being 
critical  to  the  DFAS  mission.  However,  Y2K  test  plans  developed  for  the  system 
did  not  include  criteria  for  testing  or  methods  for  correcting  deficiencies.  Also, 
the  test  results  were  not  consistently  documented  to  ensure  that  the  criteria  for 
testing  the  system  were  achieved.  Although  DFAS  financial  specialists  developed 
criteria  and  scenarios  for  testing  the  system  and  its  interfacing  systems,  they  had 
no  guidance,  such  as  standardized  Y2K  testing  procedures.  In  addition,  although 
the  Defense  Business  Management  System  manager  was  aware  that  the  test  plans 
did  not  fully  follow  the  DoD  Y2K  Management  Plan  procedures,  no  plans  had 
been  made  for  comparing  actual  test  results  with  expected  results. 

Without  planning  for  proper  and  timely  testing  of  mid-tier  computer  systems, 
DFAS  would  increase  its  risk  of  potential  data  contamination.  By  developing  and 
documenting  test  plans  and  results,  DFAS  would  facilitate  analysis  of  those 
results  and  of  remaining  risk  of  system  failures. 

Planning  for  Y2K  Contingencies.  The  DoD  Y2K  Management  Plan  requires  the 
development  of  contingency  plans  to  ensure  the  continuity  of  an  organization’s 
processes.  Also,  the  DoD  Y2K  Management  Plan  requires  cost  estimates  to  be 
developed  for  each  contingency  and  information  on  contingencies  to  be 
exchanged  with  system  users  and  managers  of  interfacing  systems. 

During  the  audit,  we  determined  that  DFAS  had  developed  contingency  plans  for 
all  but  two  of  the  systems  reviewed:  the  Transportation  Support  System  and  the 
Departmental  Financial  Reporting  and  Reconciliation  System.  However,  only  the 
plan  for  the  Defense  Business  Management  System  included  cost  estimates  for 
each  potential  contingency.  In  addition,  only  3  of  the  17  contingency  plans  had 
evidence  of  involvement  by  system  users  or  managers  outside  of  the  DFAS  office 
responsible  for  the  system. 


2  The  seven  systems  were  the  Defense  Business  Management  System,  the  Military  Traffic  Management 
Command-Financial  Management  System,  and  five  of  six  DFAS  systems  interfacing  with  the 
Mechanization  of  Contract  Administration  Services  system. 
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It  is  important  for  DFAS  to  prepare  complete  contingency  plans  that  include  cost 
estimates  and  involve  system  users  or  managers  that  have  interfaces  with  the 
systems  using  mid-tier  computers.  The  plans  would  provide  insurance  against  the 
many  possible  types  of  Y2K  disruptions  and  would  ensure  that  plans  are  in  place 
to  expedite  the  restoration  of  a  system. 

Certifications  of  Systems  as  Y2K  Compliant.  DFAS  did  not  ensure  that; 

•  systems  that  operate  on  mid-tier  computers  were  certified  as  Y2K 
compliant, 

•  monthly  reports  were  supported  by  certifications,  and 

•  systems  using  mid-tier  computers  were  certified  as  being  tested  on 
Y2K-compliant  mid-tier  computers. 

According  to  the  DoD  Y2K  Management  Plan,  developers  and  maintainers  of 
systems  and  the  personnel  using  the  systems  must  certify  and  document  that  each 
system  complies  with  DoD  Y2K  requirements. 

Management  Certifications  on  Systems  Tested.  As  of  March  5, 

1999,  5  of  the  17  systems  using  mid-tier  computer  systems  were  not  certified  as 
Y2K  compliant.  The  DoD  Y2K  Management  Plan  provided  a  deadline  of 
September  30,  1998,  for  certifying  mission-critical  systems  as  Y2K  compliant  and 
a  deadline  of  January  31, 1999,  for  certifying  all  other  systems. 

For  the  12  certified  systems,  the  system  manager,  the  project  manager,  and  the 
user  had  signed  a  checklist  confirming  that  testing  had  occurred  and  that  the  test 
results  proved  the  system  was  compliant.  (That  procedure  was  consistent  with 
requirements  in  the  DoD  Y2K  Management  Plan.)  The  12  systems  had  been 
certified  based  on  testing  conducted  by  either  DFAS,  a  contractor,  or  the  Joint 
Interoperability  Test  Command. 

Of  the  five  uncertified  systems,  DFAS  classified  the  Defense  Business 
Management  System  as  being  critical  to  its  mission.  However,  DFAS  was  not 
planning  to  re-conduct  tests  on  that  mission-critical  system;  therefore,  the  system 
was  to  move  to  the  next  stage  of  testing — end-to-end  testing — in  June  1999 
without  being  certified. 

As  of  March  5,  1999,  a  module  of  the  Departmental  Financial  Reporting  and 
Reconciliation  System  (which  resides  on  a  mid-tier  computer),  the  Transportation 
Support  System,  and  two  systems  that  interface  with  the  Mechanization  of 
Contract  Administration  Services  system  had  not  been  certified  as  Y2K 
compliant.  For  the  Transportation  Support  System,  the  interface  agreement  had 
not  been  created  or  the  interface  tested;  therefore,  the  system  manager  was  not 
able  to  certify  the  system.  The  two  systems  interfacing  with  the  Mechanization  of 
Contract  Administration  Services  system  were  in  the  process  of  being  tested; 
therefore,  the  systems  were  not  certified. 
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Y2K  Certifications  in  DFAS  Managers’  Checklists  Compared  With  DFAS 
Y2K  Monthly  Status  Reports.  Inconsistencies  existed  between  the  levels  of 
Y2K  certification  shown  in  the  checklists  that  DFAS  managers  completed  and  the 
DFAS  Y2K  monthly  status  report.  (The  DFAS  Y2K  monthly  status  report  was  a 
compilation  of  the  information  collected  from  the  Directors  of  the  DFAS 
Centers.) 

Certification  levels  were  not  shown  in  the  monthly  status  report  or  in  a  checklist 
for  5  of  the  17  systems  in  this  review.  For  the  12  systems  with  certifications,  we 
compared  the  level  of  certification  in  managers’  checklists  with  the  certification 
in  the  DFAS  Y2K  status  report  for  the  month  of  February  1999.  It  is  critical  that 
the  proper  certification  levels  for  systems  be  shown  in  the  DFAS  Y2K  status 
report  because  the  report  is  forwarded  to  the  Assistant  Secretary  of  Defense 
(Command,  Control,  Communications,  and  Intelligence)  and  is  consolidated  for 
overall  DoD  reporting  to  the  Office  of  Management  and  Budget. 

For  the  12  systems  with  checklists  containing  DFAS  certifications  of  Y2K 
compliance,  3  of  the  checklists  indicated  that  the  system  was  tested  on  a  mid-tier 
computer  system  that  was  Y2K  compliant.  Those  three  systems  were  the  Defense 
Joint  Accounting  System,  the  Industrial  Fund  Accounting  System,  and  the 
Standard  Material  Accounting  System.  The  three  systems  are  listed  under  the 
DFAS  checklist  heading  and  have  a  level  3  certification  (see  the  Table  in  this 
finding).  A  level  3  certification  indicates  that  the  system  and  its  interfaces  were 
compliant  and  the  system  was  tested  on  mid-tier  computer  systems  that  were 
compliant.  However,  the  DFAS  monthly  report  shows  nine  mid-tier  computer 
systems  that  were  certified  as  Y2K  compliant  and  were  tested  on  a  mid-tier 
computer  that  was  Y2K  compliant.  (Those  nine  systems  are  indicated  by  a  “3” 
under  the  DFAS  Monthly  Report  heading.) 

In  addition,  the  DFAS  monthly  report  indicated  that  two  mid-tier  computer 
systems  were  Y2K  compliant,  but  they  were  not  certified  as  having  been  tested  on 
a  Y2K-compliant  mid-tier  computer.3  Those  two  systems  were  the  Unmatched 
Disbursement  Reconciliation  System  and  the  Standard  Accounting  and  Reporting 
System.  However,  the  DFAS  managers’  checklists  showed  that  nine  systems 
were  compliant,  but  they  were  not  certified  as  being  tested  on  a  Y2K-compliant 
mid-tier  computer. 

DFAS  needed  to  reconcile  its  monthly  report  with  its  managers’  certifications.  If 
the  level  of  certification  changes,  DFAS  managers  should  document  the  change 
and  the  reason  for  the  change  in  their  checklist  and  update  the  monthly  report. 

The  data  shown  in  the  monthly  report  directly  impacts  on  the  accuracy  of  data  that 
DoD  uses  to  report  to  the  Office  of  Management  and  Budget. 


3  The  DFAS  Y2K  Management  Plan,  issued  in  May  1999,  defines  a  system  certified  at  level  2  as  being 
Y2K  compliant,  to  include  the  system’s  interfaces.  However,  the  tests  made  on  a  system  at  level  2  were 
not  performed  in  a  Y2K-compliant  environment. 
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DFAS  and  DoD  Y2K  Certification  Levels 


_ Certification  Level _ 

Checklist  Monthly  Report 

_ System  Name _ DFAS1  DoD2  DFAS1  DoD2 

3 

1 .  Computerized  Accounts  Payable  System  2  2a  none  none 

2.  Defense  Business  Management  System  none  none  none  none 

3.  Departmental  Financial  Reporting  and  Reconciliation  none  none  none  none 

4.  Defense  Joint  Accounting  System  3  3a  3  3a 

5.  Defense  Working  Capital  Accounting  System- 

Defense  Automated  Printing  Service  2  lb  3  la 

6.  Defense  Working  Capital  Accounting  System- 

Public  Works  Centers  2  lb  3  la 

7.  Industrial  Fund  Accounting  System  3  3a  3  lb 

8.  Contractor  Invoice  Service5  none  none  none  none 

9.  Contract  Reconciliation  System5  2  none  none  none 

10.  Entitlement  Automation  System5  2  none  3  la 

1 1 .  Electronic  Document  Management  Program5  none  none  none  none 

12.  Prevalidation  Management  Information 

Reporting  System5  2  none  3  la 

13.  Unmatched  Disbursement  Reconciliation  System5  2  none  2  la 

14.  Military  Traffic  Management  Command-Financial 

Management  System  24  none  3  2b 

15.  Standard  Materiel  Accounting  System  3  lb  3  la 

16.  Standard  Accounting  and  Reporting  System  2  la  2  lb 

17.  Transportation  Support  System  none  none  none  none 

'The  DFAS  Y2K  Management  Plan  has  two  levels  of  certification: 

(Level  1  certification  is  no  longer  used.) 

Level  2  =  system  and  interfaces  are  compliant  and  testing  was  not  in  a  compliant  environment. 
Level  3  =  system  and  interfaces  are  compliant  and  testing  was  made  in  compliant  environment. 
The  DoD  Y2K  Management  Plan  includes  the  following  levels  of  certification: 

Level  1  =  full  independent  testing  of  the  system;  Level  2  =  independent  audit  of  the  system. 
Level  3  =  self-certification  of  the  system;  “a”  =  four-digit  year;  “b”  =  two-digit  year. 

3None  =  certification  level  was  not  reported  in  the  monthly  report,  and  no  checklist  existed. 
4Certification  level  reported  by  Army  management. 

5The  systems  are  used  by  DFAS  and  interface  with  the  Mechanization  of  Contract  Administration 
Services  system. 
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Management  Actions 


DFAS  took  several  actions  toward  complying  with  DoD  Y2K  requirements  before 
and  during  this  audit.  Those  actions  will  lower  the  risk  of  system  failure. 

Making  Mid-Tier  Computers  Y2K  Compliant.  We  compared  the  versions  of 
software  installed  on  mid-tier  computer  systems  at  the  DFAS  Indianapolis  Center 
with  the  modified  Y2K-compliant  versions  suggested  by  the  mid-tier 
manufacturer.  With  the  exception  of  two  Sun  Microsystems,  Incorporated,  mid¬ 
tier  computers,  all  of  the  proper  software  modifications  were  installed.  Based  on 
our  recommendation,  the  DFAS  Indianapolis  Center  personnel  installed  the 
correct  versions  of  software  and  removed  a  noncompliant  compiler.  (A  compiler 
translates  instructions  to  a  computer  [from  a  human-readable  language  into  a 
language  understood  by  the  computer]  so  that  the  computer  can  read,  interpret, 
and  perform  the  desired  actions.) 

Establishing  Agreements  for  Interfaces  With  DFAS  Systems.  As  required  by 
the  DFAS  Y2K  Management  Plan,  DFAS  established  agreements  with  all 
required  organizations  interfacing  with  the  17  systems  reviewed.  Completion  of 
the  interface  agreements  was  important  because  the  success  of  DFAS  finance  and 
accounting  operations  depend  on  the  proper  and  timely  exchange  of  data  with 
others. 

DFAS  systems  interface  internally  with  hundreds  of  other  DFAS  systems  and 
externally  with  Military  Departments,  DoD  Components,  and  various  Federal 
Government  systems.  DFAS  receives  an  estimated  80  percent  of  the  data  used  in 
finance  and  accounting  processes  from  non-DFAS  systems.  Therefore,  the 
completion  of  the  system  interfaces  would  contribute  to  the  success  of  the  DFAS 
Y2K  compliance  program  and  toward  reducing  the  risk  of  Y2K  problems. 

Management  Certifications  of  Systems.  During  this  audit,  DFAS  continued  to 
certify  its  mid-tier  computer  systems.  The  DFAS  Y2K  monthly  status  report  for 
March  1999  showed  that  15  of  the  17  systems,  using  mid-tier  computer  systems, 
reviewed  during  this  audit  had  been  certified.  Only  the  Contractor  Invoice 
Service  and  the  Computerized  Accounts  Payable  System  for  Windows  were  not 
certified. 

Implementation  of  Systems.  For  5  of  the  17  systems  reviewed  during  this  audit, 
DFAS  had  not  implemented  Y2K  corrective  actions  by  the  target  date  of  March  1, 
1999.  One  of  the  five  systems,  the  Standard  Materiel  Accounting  System,  is 
mission-critical.  It  was  scheduled  for  implementation  on  June  30, 1999.  The 
other  four  systems  were  classified  as  nonmission-critical  systems.  Those 
systems— the  Computerized  Accounts  Payable  System  for  Windows,  the 
Departmental  Financial  Reporting  and  Reconciliation  System,  the  Defense  Joint 
Accounting  System,  and  the  Contractor  Invoice  Service— were  scheduled  for 
implementation  by  April  15, 1999;  July  31, 1999;  May  1, 1999;  and  April  30, 
1999,  respectively.  According  to  DFAS,  all  of  these  systems  are  certified  and 
implemented  as  of  July  31, 1999. 
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Conclusion 


Managers  of  the  systems  that  run  on  mid-tier  computers  were  aware  of  the  Y2K 
status  on  each  of  the  systems  and  were  actively  engaged  in  ensuring  Y2K 
compliance.  Additional  actions  were  needed  at  the  time  of  the  audit  to  minimize 
potential  risks  and  provide  greater  assurance  that  DFAS  systems  on  mid-tier 
computers  are  Y2K  compliant.  Those  specific  actions  and  other  efforts  are 
responsive  to  our  concerns. 


Recommendations,  Management  Comments,  and  Audit 
Response 

We  recommend  that  the  Director,  Defense  Finance  and  Accounting  Service: 

1.  Periodically  reconcile  and  update  the  Defense  Finance  and  Accounting 
Service  inventory  of  systems  that  operate  on  mid-tier  computers  with  the 
Defense  Information  Systems  Agency  inventory. 

DFAS  Comments.  DFAS  concurred  with  the  recommendation,  and  as  of  June  4, 
1999,  DFAS  stated  that  corrective  actions  were  in  progress.  The  Director, 
Information  and  Technology,  stated  that  DFAS  was  working  with  the  Defense 
Information  Systems  Agency  to  reconcile  and  update  the  inventories. 

2.  Develop  test  plans  for  mid-tier  computer  systems,  including  plans  for 
testing  interfaces  as  follows: 

a.  Develop  test  plans  and  conduct  tests  for  untested  systems,  or 

b.  Compare  actual  test  results  with  expected  results  to  determine 
whether  tests  were  successful;  if  the  tests  were  unsuccessful,  conduct 
additional  testing  until  desired  results  are  achieved. 

DFAS  Comments.  DFAS  partially  concurred,  and  as  of  June  4, 1999,  DFAS 
stated  that  test  plans  were  updated  based  on  audit  results;  however,  DFAS  deemed 
that  it  was  too  late  to  standardize  testing  procedures  because  systems  were  already 
tested  and  certified,  as  specified  in  the  draft  audit  recommendations. 

Audit  Response.  We  consider  the  comments  responsive.  We  agree  that,  if  all  of 
the  mid-tier  computer  systems  have  been  tested  and  certified,  standardizing  the 
testing  procedures  is  no  longer  feasible.  We  have  revised  the  recommendation. 
Additional  comments  are  not  required. 

3.  Ensure  contingency  planning  involves  system  users  or  managers  that 
have  interfaces  with  the  Defense  Finance  and  Accounting  Service  systems 
using  mid-tier  computers. 

DFAS  Comments.  DFAS  nonconcurred  with  the  draft  report  recommendation, 
which  also  addressed  cost  estimates  for  contingency  plans.  DFAS  stated  that  the 
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DoD  Y2K  office  agreed  that  the  requirement  of  identifying  costs  for  each 
potential  contingency  (which  was  referenced  in  the  DoD  Y2K  Management  Plan) 
was  not  practical.  But  DFAS  did  agree,  as  of  June  4, 1999,  to  make  a  special 
effort  toward  emphasizing  the  importance  of  coordinating  and  providing 
information  to  its  interfacing  partners. 

Audit  Response.  We  deleted  the  portion  of  the  recommendation  related  to  cost 
estimates  for  contingency  plans,  which  we  agree  are  not  essential.  The  DFAS 
comments  were  responsive  regarding  the  involvement  of  interface  partners. 

4.  Certify  systems  as  being  tested  on  year-2000-compliant  mid-tier 
computers. 

DFAS  Comments.  DFAS  concurred  with  the  recommendation,  and  as  of  June  4, 
1999,  DFAS  stated  that  each  of  the  17  DFAS  systems  reviewed  were  certified  as 
Y2K  compliant.  In  further  discussions,  DFAS  indicated  that  all  of  the  systems 
were  now  implemented,  as  well. 
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Appendix  A.  Audit  Process 


This  report  is  one  in  a  series  of  reports  being  issued  by  the  Inspector 
General,  DoD,  in  accordance  with  an  informal  partnership  with  the  Chief 
Information  Officer,  DoD,  to  monitor  DFAS  efforts  to  address  the  Y2K 
computing  challenge.  For  a  listing  of  audit  projects  addressing  the  issue, 
see  the  Y2K  web  page  at  http://www.ignet.gov. 


Scope 

This  audit  included  reviews  of  DFAS  mid-tier  computer  systems.  As  of 
March  1,  1999,  DFAS  reported  that  it  had  33  systems  using  mid-tier 
computer  systems.  We  selected  17  of  those  systems  managed  by  DFAS  or 
DISA. 

We  applied  criteria  outlined  in  the  “DoD  Year  2000  Management  Plan,” 
version  2.0,  December  1998,  and  the  DFAS  Y2K  Management  Plan, 
December  1997,  version  1.0,  to  assess  the  progress  achieved  by  DFAS 
toward  reducing  the  risk  of  a  Y2K  failure. 

We  reviewed  DFAS  and  DISA  Y2K  databases  and  inventories  of  mid-tier 
computer  systems.  Also,  we  held  discussions  with  DFAS  and  DISA 
managers  to  identify  the  locations  and  types  of  mid-tier  computer  systems 
used  to  process  DFAS  data. 

DoD- Wide  Corporate-Level  Government  Performance  and  Results  Act 
Goals.  In  response  to  the  Government  Performance  and  Results  Act,  DoD 
has  established  6  DoD-wide  corporate-level  performance  objectives  and  14 
goals  for  meeting  the  objectives.  This  report  pertains  to  achievement  of  the 
following  objective  and  goal. 

Objective:  Prepare  now  for  an  uncertain  future.  Goal:  Pursue  a 
focused  modernization  effort  that  maintains  U.S.  qualitative 
superiority  in  key  warfighting  capabilities.  (DoD-3) 

DoD  Functional  Area  Reform  Goals.  Most  major  DoD  functional  areas 
have  also  established  performance  improvement  reform  objectives  and 
goals.  This  report  pertains  to  achievement  of  the  following  functional  area 
objectives  and  goals. 

•  Information  Technology  Management  Functional  Area. 
Objective:  Become  a  mission  partner.  Goal:  Serve  mission 
information  users  as  customers.  (Information  Technology 
Management-1.2) 

•  Information  Technology  Management  Functional  Area. 
Objective:  Provide  services  that  satisfy  customer  information 
needs.  Goal:  Modernize  and  integrate  Defense  information 
infrastructure.  (Information  Technology  Management-2.2) 
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•  Information  Technology  Management  Functional  Area. 
Objective:  Provide  services  that  satisfy  customer  information 
needs.  Goal:  Upgrade  technology  base.  (Information 
Technology  Management-2.3) 

General  Accounting  Office  High-Risk  Area.  The  General  Accounting 
Office  has  identified  several  high  risk  areas  in  DoD.  This  report  provides 
coverage  of  the  Information  Management  and  Technology  high-risk  area. 


Methodology 

Audit  Type,  Dates,  and  Standards.  We  performed  this  program  audit 
from  November  1998  through  March  1999,  in  accordance  with  auditing 
standards  issued  by  the  Comptroller  General  of  the  United  States,  as 
implemented  by  the  Inspector  General,  DoD.  We  used  nonstatistical 
sampling  methods,  and  we  did  not  use  computer-processed  data  for  this 
audit. 

Contacts  During  the  Audit.  We  visited  or  contacted  individuals  and 
organizations  within  DoD.  Further  details  are  available  upon  request. 

Management  Control  Program.  We  did  not  review  the  management 
control  program  related  to  the  overall  audit  objective  because  DoD 
recognized  the  Y2K  issue  as  a  material  management  control  weakness  area 
in  the  FY  1998  Annual  Statement  of  Assurance. 


Appendix  B.  Summary  of  Prior  Coverage 


Forty-nine  Inspector  General,  DoD,  reports  covered  issues  related  to  this 
audit. 


Inspector  General 

Inspector  General,  DoD,  Report  No.  99-086,  “Year  2000  Issues  Within  the 
U.  S.  Pacific  Command’s  Area  of  Responsibility  -  III  Marine  Expeditionary 
Forces,”  February  22, 1999. 

Inspector  General,  DoD,  Report  No.  99-085,  “Year  2000  Issues  Within  the 
U.  S.  Pacific  Command’s  Area  of  Responsibility -Hawaii  Information 
Transfer  System,”  February  22, 1999. 

Inspector  General,  DoD,  Report  No.  99-082,  “Year  2000  Computing  Issues 
Related  to  the  Defense  Automatic  Addressing  System  Center,”  February  18, 
1999. 

Inspector  General,  DoD,  Report  No.  99-081, “Tooele  Chemical  Agent 
Disposal  Facility  Preparation  for  Year  2000,”  February  16, 1999. 

Inspector  General,  DoD,  Report  No.  99-079,  “Y ear  2000  Conversion 
Program  at  the  Dugway  Proving  Ground  Major  Range  and  Test  Facility,” 
February  9,  1999. 

Inspector  General,  DoD,  Report  No.  99-076,  “Year  2000  Posture  of  DoD 
Mid-Tier  Computer  Systems,”  February  3, 1999. 

Inspector  General,  DoD,  Report  No.  99-074,  “Year  2000  Conversion  at  the 
Atlantic  Fleet  Weapons  Training  Facility,”  January  29, 1999. 

Inspector  General,  DoD,  Report  No.  99-070,  “Year  2000  Conversion 
Program  at  Hill,  Patrick,  Holloman,  and  Vandenberg  Air  Force  Bases,” 
January  22, 1999. 

Inspector  General,  DoD,  Report  No.  99-063,  “Global  Positioning  System 
Receiver  Compliance  with  Year  2000  Requirements,”  December  31, 1998. 

Inspector  General,  DoD,  Report  No.  99-060,  “Johnston  Atoll  Chemical 
Agent  Disposal  System  Preparation  for  Year  2000,”  December  24, 1998. 

Inspector  General,  DoD,  Report  No.  99-058,  “Year  2000  Conversion  of 
Defense  Critical  Suppliers,”  December  18, 1998. 

Inspector  General,  DoD,  Report  No.  99-055,  “Year  2000  Computing  Issues 
Related  to  Health  Care  in  DoD,”  December  15, 1998. 
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Inspector  General,  DoD,  Report  No.  99-052,  “Year  2000  Conversion  of 
Logistics  and  Maintenance  Systems  in  Support  of  the  Airborne  Warning 
and  Center  System,”  December  11, 1998. 

Inspector  General,  DoD,  Report  No.  99-049,  ‘Tear  2000  Contingency 
Planning  and  Cost  Reporting  at  the  Defense  Finance  and  Accounting 
Service,”  December  10, 1998. 

Inspector  General,  DoD,  Report  No.  99-046,  “Year  2000  Initiatives  at  the 
Army  Kwajalein  Missile  Range,”  December  4,  1998. 

Inspector  General,  DoD,  Report  No.  99-039,  “552nd  Air  Control  Wing  Year 
2000  Infrastructure  Program  for  the  Airborne  Warning  and  Control 
System,”  November  23, 1998. 

Inspector  General,  DoD,  Report  No.  99-038,  “Year  2000  Initiatives  at  the 
Pacific  Missile  Range  Facility,”  November  23, 1998. 

Inspector  General,  DoD,  Report  No.  99-036,  “Army  Research  Laboratory 
Preparation  for  the  Year  2000,”  November  13, 1998. 

Inspector  General,  DoD,  Report  No.  99-035,  “Army  Medical  Research 
Institute  of  Infectious  Diseases  Preparation  of  the  Year  2000,” 

November  13, 1998. 

Inspector  General,  DoD,  Report  No.  99-034,  “Management  of  the  On-Site 
Inspection  Agency  Year  2000  Program,”  November  12, 1998. 

Inspector  General,  DoD,  Report  No.  99-031,  “U.  S.  Pacific  Command  Year 
2000  Issues,”  November  3, 1998. 

Inspector  General,  DoD,  Report  No.  99-030,  “Management  of  the  Defense 
Technology  Security  Administration  Year  2000  Program,”  November  3, 
1998. 

Inspector  General,  DoD,  Report  No.  99-028,  “Management  of  the  Defense 
Special  Weapons  Agency  Year  2000  Program,”  October  30, 1998. 

Inspector  General,  DoD,  Report  No.  99-027,  “DoD  Base  Communications 
Systems  Compliance  with  Year  2000  Requirements,”  October  30, 1998. 

Inspector  General,  DoD,  Report  No.  99-022,  “Year  2000  Conversion  at  the 
Army  Major  Range  and  Test  Facilities,”  October  29,  1998. 

Inspector  General,  DoD,  Report  No.  99-017,  “Year  2000  Conversion  of  the 
Airborne  Warning  and  Control  System,”  October  19, 1998. 

Inspector  General,  DoD,  Report  No.  99-015,  “Joint  Centers’  Year  2000 
Issues,”  October  16, 1998. 

Inspector  General,  DoD,  Report  No.  99-003,  “Air  Force  Research 
Laboratory  Preparation  for  Year  2000,”  October  5, 1998. 
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Inspector  General,  DoD,  Report  No.  98-218,  “Major  Range  and  Test 
Facility  Base  Year  200  Initiatives  at  the  Naval  Air  Warfare  Center  - 
Aircraft  and  Weapons  Divisions,  and  the  Atlantic  Undersea  Test  and 
Evaluation  Center,”  September  30, 1998. 

Inspector  General,  DoD,  Report  No.  98-203,  “Naval  Research  Laboratory 
Preparation  for  Year  2000,”  September  23, 1998. 

Inspector  General,  DoD,  Report  No.  98-207,  “Year  2000  Contract 
Language  for  Weapons  Systems,”  September  22,  1998. 

Inspector  General,  DoD,  Report  No.  98-196,  “Navy  Special  Access 
Program  Community  Preparation  for  Year  2000  Compliance,”  August  28, 
1998. 

Inspector  General,  DoD,  Report  No.  98-194,  “U.S.  Atlantic  Command  Year 
2000  Issues,”  August  27,  1998. 

Inspector  General,  DoD,  Report  No.  98-193,  “Evaluation  of  the  Defense 
Megacenters  Year  2000  Program,”  August  25, 1998. 

Inspector  General,  DoD,  Report  No.  98-188,  “U.S.  Space  Command  Year 
2000  Issues,”  August  18,  1998. 

Inspector  General,  DoD,  Report  No.  98-187,  “Year  2000  Computing 
Problem  at  Air  Force  Major  Range  and  Test  Facilities,”  August  14, 1998. 

Inspector  General,  DoD,  Report  No.  98-184,  “Management  of  the  Defense 
Information  Systems  Agency  Year  2000  Program,”  August  4, 1998. 

Inspector  General,  DoD,  Report  No.  98-182,  “Year  2000  Program  at  the 
Defense  Advanced  Research  Projects  Agency,”  July  31, 1998. 

Inspector  General,  DoD,  Report  No.  98-180,  “Ballistic  Missile  Defense 
Organization  Year  2000  Initiatives,”  July  16,  1998. 

Inspector  General,  DoD,  Report  No.  98-173,  “U.S.  Central  Command  Year 
2000  Issues,”  July  2, 1998. 

Inspector  General,  DoD,  Report  No.  98-169,  “DoD  Year  2000  Computing 
Problems:  Lessons  Learned  From  the  Defense  Integration  Support  Tools 
Database,”  June  29, 1998. 

Inspector  General,  DoD,  Report  No.  98-147,  “Year  2000  Certification  of 
Mission-Critical  DoD  Information  Technology  Systems,”  June  5, 1998. 

Inspector  General,  DoD,  Report  No.  98-129,  “U.S.  Special  Operations 
Command  Year  2000  Issues,”  May  8, 1998. 
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Inspector  General,  DoD,  Report  No.  98-1 12,  “Year  2000  Reporting  for 
Defense  Finance  and  Accounting  Service  Cleveland  Center  Systems,” 

April  17, 1998. 

Inspector  General,  DoD,  Report  No.  98-1 11,  “Year  2000  Initiatives  at  the 
Defense  Finance  and  Accounting  Service  Cleveland  Center,”  April  16, 

1998. 

Inspector  General,  DoD,  Report  No.  98-077,  “Year  2000  Computing 
Problem  Reports:  August  1997  Report,”  February  18, 1998. 

Inspector  General,  DoD,  Report  No.  98-074,  “Sharing  Year  2000  Testing 
Information  on  DoD  Information  Technology  Systems,”  February  12, 1998. 

Inspector  General,  DoD,  Report  No.  98-068,  “Year  2000  Compliance  in  an 
Air  Force  Special  Access  Program,”  February  6, 1998. 

Inspector  General,  DoD,  Report  No.  98-065,  “DoD  Information  Technology 
Solicitations  and  Contract  Compliance  for  Year  2000  Requirements,” 
February  6, 1998. 
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Appendix  C.  Glossary 


Application  Program.  An  application  program  is  a  computer  program  to 
help  people  perform  a  certain  type  of  work.  Depending  on  the  work  for 
which  it  was  designed,  an  application  can  manipulate  text,  numbers, 
graphics,  or  a  combination  of  those  elements. 

Computer  Hardware.  Computer  hardware  is  the  physical  components  of 
a  computer  system,  including  the  central  processing  unit,  and  peripherals, 
such  as  printers,  tapes,  and  disks. 

Mission-Critical  Systems.  Mission-critical  systems  include  the 
following: 


•  systems  defined  by  the  Information  Technology  Management 
Reform  Act  (Clinger-Cohen  Act)  as  National  Security  Systems 
(intelligence  activities,  cryptologic  activities  related  to  national 
security,  command  and  control  of  military  forces  integral  to  a 
weapon  or  weapon  systems,  systems  critical  to  direct  fulfillment 
of  military  or  intelligence  missions); 

•  systems  identified  by  the  Commanders-in-Chief  that,  if  not 
functional,  would  preclude  the  Commanders-in-Chief  from 
conducting  missions  across  the  full  spectrum  of  operations;  and 

•  systems  required  to  perform  Department-level  and  DoD 
Component-level  core  functions. 

Testing.  Testing  consists  of  actions  to  determine  whether  the  results 
generated  by  the  information  systems  and  their  components  are  accurate 
and  whether  the  systems  perform  to  specifications. 


Appendix  D.  Defense  Finance  and  Accounting 
Service  Systems  Selected  for  Review 


We  reviewed  the  following  systems  that  used  mid-tier  computers  to  process 
DFAS  data. 

1.  Computerized  Accounts  Payable  System  for  Windows.  The 

Computerized  Accounts  Payable  System  for  Windows  is  the  newest  version 
of  the  Computerized  Accounts  Payable  System  software.  The  system 
processes  installation  and  center-level  vendor  payments  for  the  Army  and 
the  Defense  Logistics  Agency.  Also,  it  processes  International  Merchant 
Purchase  Authority  Card  payments  for  the  Marine  Corps.  The  system  is 
processed  on  two  mid-tier  computers,  and  it  was  built  Y2K  compliant.  It 
was  implemented  on  March  31, 1999. 

2.  Defense  Business  Management  System.  The  Defense  Business 
Management  System  is  critical  to  accomplishing  the  DFAS  mission.  It  is 
the  accounting  system  for  the  Defense  Working  Capital  Fund  in  support  of 
DFAS,  the  Defense  Commissary  Agency,  the  Air  Force  Materiel 
Command,  and  Naval  Supply.  It  has  four  major  subsystems— personnel, 
payroll,  resource  administration,  and  appropriation  accounting — and 
processes  on  one  mid-tier  computer.  The  Defense  Business  Management 
System  was  implemented  by  March  31, 1999. 

3.  Departmental  Financial  Reporting  and  Reconciliation  System.  The 

Departmental  Financial  Reporting  and  Reconciliation  System  is  the  general 
accounting  system  responsible  for  cash  accountability,  expenditure 
reporting,  and  reconciliation  for  all  appropriations.  One  module  of  the 
system,  the  Cross-Disbursing  module,  is  processed  on  one  mid-tier 
computer.  The  remainder  of  the  system  is  on  a  mainframe  computer.  The 
system  is  in  the  implementation  phase,  with  the  Cross-Disbursing  module 
scheduled  to  be  replaced  in  April  1999,  and  the  entire  system  scheduled  to 
be  implemented  by  July  31, 1999. 

4.  Defense  Joint  Accounting  System.  The  Defense  Joint  Accounting 
System  is  the  general  fund  accounting  system  for  DFAS  Indianapolis  and 
DoD  agency  customers.  The  Defense  Joint  Accounting  System’s  software 
was  obtained  from  the  Army  Corps  of  Engineers  Financial  Management 
System.  The  Defense  Joint  Accounting  System  was  operational  at  its  first 
customer  site,  the  Ballistic  Missile  Defense  Organization.  The  system  was 
being  developed  to  process  on  a  mid-tier  computer. 

5.  Defense  Working  Capital  Accounting  System-Defense  Automated 
Printing  Service.  The  Defense  Working  Capital  Accounting  System- 
Defense  Automated  Printing  Service  is  a  mission-critical  system  and  a 
migratory  system  to  replace  the  Defense  Automated  Printing  Service’s 
Printing  Resource  Management  Information  System.  The  Defense  Working 
Capital  Accounting  System-Defense  Automated  Printing  Service  was 
fielded  in  October  1998  and  runs  on  a  mid-tier  computer  at  the  DISA 
Megacenter  at  Wamer-Robbins  Air  Force  Base  in  Georgia. 
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6.  Defense  Working  Capital  Accounting  System-Public  Works  Centers. 

The  Defense  Working  Capital  Accounting  System-Public  Works  Centers  is 
considered  a  mission-critical  system  to  replace  the  Naval  Facilities 
Engineering  Command’s  Public  Works  Center  Management  Information 
System.  The  working  capital  and  general  fund  accounting  support  was  to 
be  transferred  to  the  Defense  Working  Capital  Accounting  System-Public 
Works  Centers  from  the  Naval  information  system.  The  Defense  Working 
Capital  Accounting  System-Public  Works  Centers  is  processed  on  one 
mid-tier  computer  at  die  DIS  A  Megacenter  in  San  Diego,  California. 

7.  Financial  Management  System.  The  Military  Traffic  Management 
Command’s  worldwide  Financial  Management  System  is  critical  to  the 
DFAS  mission.  It  is  a  dedicated,  online,  interactive  finance  and  accounting 
system  processing  “For  Official  Use  Only”  information.  It  supports  the 
Military  Traffic  Management  Command  transportation  operations 
associated  with  Transportation  Working  Capital  Funds  and  appropriated 
funds.  It  performs  finance  and  accounting  functions  and  produces  finance 
and  accounting  reports.  The  system  is  processed  on  three  mid-tier 
computers  and  was  implemented  on  January  19, 1999. 

8.  Industrial  Fund  Accounting  System.  The  Industrial  Fund  Accounting 
System,  a  mission-critical  system,  processes  information  for  the  Defense 
Working  Capital  Fund.  It  consists  of  three  subsystems — accounting, 
budget,  and  data  collection.  The  budget  subsystem  is  processed  on  both 
mid-tier  and  mainframe  computers,  and  the  accounting  and  data  collection 
subsystems  are  on  a  mainframe  computer.  The  Industrial  Fund  Accounting 
System  was  implemented  on  March  1, 1999. 

9.  Standard  Materiel  Accounting  System.  The  Standard  Materiel 
Accounting  System  is  designated  as  mission-critical  and  as  an  interim 
migratory  Defense  Working  Capital  Fund  system  that  provides  retail 
financial  accounting  support  to  the  Air  Force  retail  supply  management 
business  area.  The  system  is  processed  on  one  mid-tier  computer.  It  was 
implemented  on  May  20,  1999. 

10.  Standard  Accounting  and  Reporting  System.  The  Standard 
Accounting  and  Reporting  System  is  a  mission-critical  system  developed 
for  the  Department  of  the  Navy  to  consolidate  all  of  its  general  fund 
accounting,  commercial,  and  reporting  operations.  It  is  a  standardized 
financial  management  and  automated  accounting  data  processing  system. 
The  subsystem  reviewed  in  this  audit — the  Automated  Prevalidation 
Subsystem — is  processed  on  one  mid-tier  computer  and  is  scheduled  to  be 
moved  to  a  mainframe  computer  in  mid-year  1999.  The  Standard 
Accounting  and  Reporting  System  was  implemented  by  March  31, 1999. 

11.  Transportation  Support  System.  The  Transportation  Support  System 
processes  invoices;  Government  bills  for  personal  property,  household 
goods,  and  freight;  and  commercial  bills  for  the  Navy,  and  it  provides  data 
to  the  Standard  Accounting  and  Reporting  System.  The  system  is  processed 
on  one  mid-tier  computer,  and  it  was  implemented  on  March  29, 1999. 
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Mechanization  of  Contract  Administration  Services  System.  The 

Mechanization  of  Contract  Administration  Services  system  is  amission- 
critical  system  managed  by  the  Defense  Logistics  Agency.  The  system  was 
implemented  on  January  19, 1999.  It  processes  on  a  mainframe  computer, 
and  although  it  was  not  part  of  this  audit  because  the  audit  was  limited  to 
reviews  on  DFAS  systems,  it  interfaces  with  the  following  six  DFAS 
systems.  (These  six  DFAS  systems  operate  on  Hewlett  Packard  mid-tier 
computers.) 

12.  Prevalidation  Management  Information  Reporting  System.  The 

Prevalidation  Management  Information  Reporting  System  provides 
management  reports  on  invoices  requiring  prevalidation.  Also,  it  extracts 
data  from  the  Mechanization  of  Contract  Administration  Services  system 
and  the  Payment  Prevalidation  Module  to  provide  the  status  on  invoices. 

The  system  is  capable  of  providing  standardized  and  nonstandard  reports. 

13.  Unmatched  Disbursement  Reconciliation  System.  The  Unmatched 
Disbursement  Reconciliation  System  interfaces  with  the  Elimination  of 
Unmatched  Disbursement  System  to  validate  that  funds  are  available  at  the 
local  accounting  offices.  That  information  is  sent  to  the  Prevalidation 
Management  Information  Reporting  System  for  validation  of  proposed 
payments. 

14.  Entitlement  Automation  System.  The  Entitlement  Automation 
System  automates  the  manual  payment  process  for  contract  entitlements. 
The  system  allows  users  to  view  contract  information  extracted  from  the 
Mechanization  of  Contract  Administration  Services  system.  Also,  it 
automates  the  input  of  payment  data  into  the  Mechanization  of  Contract 
Administration  Services  system. 

15.  Electronic  Document  Management  Program.  The  Electronic 
Document  Management  Program  is  used  to  scan  documents  and  to  provide 
users  with  on-line  access  to  financial  documents  and  information.  Also,  it 
improves  customer  services,  and  it  ensures  the  use  of  consistent  business 
processes.  The  system  was  designed  to  eliminate  paper,  reduce  costs,  and 
improve  service. 

16.  Contractor  Invoice  Service.  The  Contractor  Invoice  Service  provides 
contractors  with  the  ability  to  perform  inquiries  on  the  status  of  their 
invoices  in  the  Mechanization  of  Contract  Administration  Services  system. 

17.  Contract  Reconciliation  System.  The  Contract  Reconciliation  System 
facilitates  the  reconciliation  of  contracts  in  the  Mechanization  of  Contract 
Administration  Services  system. 


21 


Appendix  E.  Defense  Finance  and 
Accounting  Service  Systems  on  Mid-Tiers 


Title  of  DFAS  System  _ 


Date  of  Inventory: 


Automation  of  Procurement  &  Accounting  Data  Entry _  I 


Automated  Time,  Attendance  and  Production  System  -  Windows _ 


Base  Accounts  Receivable  System  _ _ _ _ 


Computerized  Accounts  Payable  System _ 


Computerized  Accounts  Payable  System  (Windows  Version) _ 


Centralized  Disbuising  System  _ 


Corporate  Electronic  Funds  Transfer _ 


C  Goal  Workload  Code _ _ 


Contract  Reconciliation  System  _ _ 


Defense  Business  Management  System-Automated  Billing  System _ 


Defense  Business  Management  System  Mid-Ttei  Interface  8  5 _ 


Defense  Business  Management  System  | 


Defense  Cash  Accountability  System 


Departmental  Cash  Management  System _ 


Departmental  Data  Base _ _ 


Defense  Departmental  Reporting  System _ 

Departmental  Financial  Reporting  &  Reconciliation  System -  Cross  Disbursing 


Defense  Joint  Accounting  System  _ 


Defense  Property  Accountability  System _ 


Defense  Procurement  Payment  System _ 


Defense  Transportation  Payments  System  -Accounting _ 


Defense  Working  Capital  Accounting  System-Public  Works  Centers _ 


Defense  Working  Capital  Accounting  System-Defense  Automated  Printing 
Service  _ 


Defense  Standard  Disbursing  System  _ 


Entitlement  Automation  System  _ _ 


Electronic  Document  Access  _ 


Electronic  Document  Access/Indexing  _ _ _ 


Electronic  Data  Interchange/8 1 0  _ _ 


Electronic  Document  Management  Program _ 


Financial  Reporting  System  _ 


File  Tracking  System  _ 


General  Accounting  and  Finance  System-  Defense  Travel  System _ 


Garnishment  Support  System  -  Integrated  Garnishment  Subsystem 


DISA  Inventory 


1/4/99  1/26/99  2/10/99 


XXX 


DFAS  Inventory 


11/24/98  |  3/1/99  | 


Integrated  Automated  Travel  System 

Industrial  Fund  Accounting  System 

Integrated  Garnishment  System 

Information  Transaction  Router 

Military  Traffic  Management  Command-Financial  Management  System _ 


Navy  Automated  Transportation  Data  System _ 

On-Line  Reports  System _ 

Pass  Thru _ _ _ 

Program  and  Budget  Accounting  System-  Funds  Distribution 


Prevalidation  Management  Information  Reporting  System _ 


Performance  Measurement  Indicators  System  _  ____ 


Standard  Materiel  Accounting  System  _ 


Standard  Accounting  and  Reporting  -  Automated  Prevalidation  Subsystem 


Resource  Analysis  Decision  Support  System  _ 


Tax  Machine  Readable  Input  _ 


Transportation  Support  System _ _ 

Uniform  Automatic  Data  Processing  System  -  Stock  Point  applications  E  and  F"~ 


Unmatched  Disbursement  Reconciliation  System  _  _ 


Work  Year  and  Personnel  Cost  _ _ 


Total  Number  of  DFAS  Systems 


22 


XX  XXX  X  XXX  XXX  XXX  XXX  XX  XXX  X  X  xxxxx  X  XX 


Appendix  F.  Report  Distribution 


Office  of  the  Secretary  of  Defense 

Under  Secretary  of  Defense  (Comptroller) 

Deputy  Chief  Financial  Officer 
Deputy  Comptroller  (Program/Budget) 

Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and  Intelligence) 
Deputy  Chief  Information  Officer  and  Deputy  Assistant  Secretary  of  Defense  (Chief 
Information  Officer  Policy  and  Implementation) 

Principal  Director  for  Year  2000 
Director,  Defense  Logistics  Studies  Information  Exchange 


Department  of  the  Army 

Inspector  General,  Department  of  the  Army 
Auditor  General,  Department  of  the  Army 


Department  of  the  Navy 

Assistant  Secretary  of  the  Navy  (Financial  Management  and  Comptroller) 
Inspector  General,  Department  of  the  Navy 
Auditor  General,  Department  of  the  Navy 
Inspector  General,  Marine  Corps 


Department  of  the  Air  Force 

Assistant  Secretary  of  the  Air  Force  (Financial  Management  and  Comptroller) 
Inspector  General,  Department  of  the  Air  Force 
Auditor  General,  Department  of  the  Air  Force 


Other  Defense  Organizations 

Director,  Defense  Contract  Audit  Agency 
Director,  Defense  Finance  and  Accounting  Service 
Director,  Defense  Information  Systems  Agency 

Inspector  General,  Defense  Information  Systems  Agency 
United  Kingdom  Liaison  Officer,  Defense  Information  Systems  Agency 
Director,  Defense  Logistics  Agency 
Director,  National  Security  Agency 

Inspector  General,  National  Security  Agency 
Inspector  General,  Defense  Intelligence  Agency 
Commandant,  Defense  Systems  Management  College 
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Non-Defense  Federal  Organizations 


Office  of  Management  and  Budget 
Office  of  Information  and  Regulatory  Affairs 
General  Accounting  Office 

National  Security  and  International  Affairs  Division 
Technical  Information  Center 

Director,  Defense  Information  and  Financial  Management  Systems,  Accounting  and 
Information  Management  Division 


Congressional  Committees  and  Subcommittees,  Chairman  and 
Ranking  Minority  Member 

Senate  Committee  on  Appropriations 

Senate  Subcommittee  on  Defense,  Committee  on  Appropriations 

Senate  Committee  on  Armed  Services 

Senate  Committee  on  Governmental  Affairs 

Senate  Special  Committee  on  the  Year  2000  Technology  Problem 

House  Committee  on  Appropriations 

House  Subcommittee  on  Defense,  Committee  on  Appropriations 
House  Committee  on  Armed  Services 
House  Committee  on  Government  Reform 

House  Subcommittee  on  Government  Management,  Information,  and  Technology, 
Committee  on  Government  Reform 

House  Subcommittee  on  National  Security,  Veterans  Affairs,  and  International 
Relations  Committee  on  Government  Reform 
House  Subcommittee  on  Technology,  Committee  on  Science 
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Defense  Finance  and  Accounting  Service 
Comments 


DFAS-HQ/S 


DEFENSE  FINANCE  AND  ACCOUNTING  SERVICE 


1931  JEFFERSON  DAVIS  HIGHWAY 
ARLINGTON,  VA  22240-929! 

JUN 


4  1999 


MEMORANDUM  FOR  DIRECTOR,  FINANCE  AND  ACCOUNTING  DIRECTORATE, 
OFFICE  OF  THE  INSPECTOR  GENERAL,  DEPARTMENT  OF 
DEFENSE 


SUBJECT;  Audit  Report  on  Year  2000  Posture  of  Mid-Tier  Computer 
Systems  Processing  at  Defense  Finance  and  Accounting 
Service  {Project  No,  9FG  9009) 


This  memorandum  is  in  response  to  the  Department  of  Defense 
(DoD) ,  Inspector  General's  (IG)  draft  report  after  review  of  the 
Defense  Finance  and  Accounting  Service  (DFAS)  Mid -Tier  Computer 
Systems  Processing.  DFAS ' s  responses  to  the  DoD  IG 
recommendations  are  as  follows;  Additional  comments  and 
clarifications  are  attached. 

1.  pp-ri  nHi  nai  ly  recQnci  i p  and  update  the  Defense  Finance  and 
ftnnmrnt- 1  ngr  Service  Inventory  of  gyatema  that  operate -Onmid- 
ZIejl  computers  with  the  Defense  Information  Systems  Agfincv 
wm-nrv.  Concur.  DFAS  has  been  working  with  DISA  to 
reconcile  and  update  our  inventories.  This  is  an  ongoing 
effort  and  records  will  be  updated  on  a  periodic  basis. 

2.  Develop  test  plans  for  systems  operating  on  mid-tier 
computers,  including  plans  for  testing  interfaces  as  follows: 
(a)  Standardize  testing  procedures  to  promote  consistency  and 
completeness  in  the  testing  process  (b)  Develop  test  plans  and 
conduct  teste  for  untested  systems,  or  (c)  Compare  actual  test 
results  with  expected  results  to  determine  if  tests  were 
successful,  if  the  tests  were  unsuccessful,  conduct  additional 
testing  until  desired  results  are  achieved.  Partially  concur. 
Test  plans  were  updated  based  on  the  audit  results;  however, 
trying  to  standardize  testing  procedures  at  this  late  date 
would  not  have  the  intended  effect  since  all  of  the  mid-tier 
systems  have  already  been  tested  and  certified.  Action  is 
completed. 

3 .  |?pvt  bp  contingency  plans  tn  include  cost  estimates  and  the 
•involvement  of  ayfltem  users  or  managers  that  have  interfaces. 

pity i  the  Defense  Finance  and  Accounting  Service  systems  U fling 

mi C-tier  oomputers.  Non-Concur.  DFAS  disagrees  with  the 
recommendation  regarding  cost  estimates.  Action  is  completed. 

4 .  .re t-M  fy  systems  an  being  tented  on  Year  2  0QQ  ..cnmnliant  mid- 
n»r  computer a.  Concur.  All  DFAS  systems  will  be  certified 
for  Y2K  compliance.  Action  is  completed. 
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Any  questions  regarding  this  response  can  be  directed  to 
Sharon  Brustad,  D FAS -HQ/ SB,  on  (317)  510-5647. 


/  C»  Vance  Kauzlarich 
Director,  Information  and  Technology 


Attachment 
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DFAS  is  confident  that  its  mid-tier  computers  and  systems  will  be  Y2K  compliant  All  of  the  17 
systems  reviewed  have  been  certified  as  Y2K  compliant.  The  following  are  comments  or 
clarifications  to  the  DoD  10  draft  report 

1  Reconciling  and  Updating  the  Inventory  of  Systems,  Almost  all  of  the  inventory  mismatches 
were  caused  by  non-DFAS  systems  being  included  on  the  list  and  DISA  reporting 
subsystems  while  DFAS  reported  at  the  system  level  DFAS  and  DISA  are  working  to 
,  update  the  inventories. 

The  two  systems  the  audit  refers  to  as  missing  from  the  DFAS  inventory  are  the  Electronic 
Document  Management  System  (EDMS)  and  the  Contractor  Invoice  Inquiry  System  (COINS). 
EDMS  is  on  the  DFAS  Inventory  as  the  Electronic  Document  Management  Program.  COINS  is 
not  on  the  DFAS  Mid-tier  Inventory  because  it  is  not  really  a  mid-tier  system.  COINS  is  a  PC 
based  bulletin  board  residing  on  an  80486  file  server  with  32  incoming  phone  lines  run  out  of  the 
DMC. 

2.  Plans  for  Testing  DFAS  Systems  Using  Mid-Tier  Computers  Seven  systems  were  listed  as 
not  having  an  adequate  test  plan. 

a.  Mil itary  Traffic  Management  Command-Financial  Management  System  (MTMC-FMS) 
The  Department  of  Army,  Military  Traffic  Management  Command  developed  and 
executed  the  test  plan  for  this  system.  MTMC-FM  was  audited,  including  a  review  of  the 
test  information,  and  certified  at  DoD  Level  2. 

b.  Defense  Business  Management  System  (DBMS).  The  auditor’s  looked  at  the  mid-tier 
processes  as  a  stand-alone  function  instead  of  a  subsystem  of  DBMS.  DFAS  believes  tha 
testing  must  encompass  the  entire  process,  not  just  that  portion  performed  on  a  mid-tier 
application.  Therefore,  testing  included  mid-tier  and  mainframe  processes,  because  the 
general  ledger  updates  occur  only  in  the  mainframe  environment.  While  it  is  true  that 
there  were  no  specified  expectations  for  the  mid-tier  processes  themselves,  the 
transactions  were  followed  all  the  way  through  to  the  general  ledger.  Although  the 
auditor’s  indicated  in  the  body  of  the  report  that  DBMS  did  not  compare  actual  results 
achieved  in  the  test  to  the  expected  result,  DFAS  believes  that  its  test  team  did  perform 
this  function. 

c.  Five  of  six  systems  interfacing  with  the  Mechanization  of  Contract  Administration 
Services  system.  All  six  DFAS  systems  performed  System  Acceptance  Testing  utilizing 
specific  test  conditions  developed  based  on  the  certification  checklist  and  the  users 
knowledge  of  the  systems  use  of  dates.  All  systems  were  tested  by  programmers  in  a 
System  Integration  Test  (SIT)  and  independently  tested  in  a  System  Acceptance  Test 
(SAT)  by  functional  DFAS  personnel  As  a  result  of  the  DoD-IG  Audit,  the  DFAS 
systems  managers  recognized  the  need  for  formal  test  plans  to  satisfy  external  reviews  of 
their  Y2K.  efforts  and  have  subsequently  developed  formal  test  plans. 

3.  planning  for  Y2K  Contingencies,  DFAS  has  identified  estimated  additional  costs  associated 
with  preventive  contingency  actions  related  to  Y2K.  These  costs  were  submitted  to  C3I  in 
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October  1998.  In  March  1 999,  these  costs  were  revised  and  resubmitted  based  upon  OUSD 
©  approved  changes  inY2K  contingency  plans  (e.g.,  contingency  planning  for  printing 
checks  for  25  percent  versus  1 00  percent  of  EFT  payments)  which  reduced  the  costs 
dramatically.  We  have  also  established  cost  account  codes  and  job  order  numbers  to  assist 
with  tracking  of  expenses  associated  with  actions  related  to  contingency  plans  including 
preparing  for  contingency  check  printing,  pre-positioning  of  payments,  zero  day  preparations 
and  actions,  and  live  testing  of  contingency  plans. 

a.  We  do  not  believe  it  is  critical  to  identify  costs  for  “each”  potential  contingency  operation 
and  that  revising  contingency  plans  to  include  these  cost  estimates  has  very  little  practical 
value.  Early  in  the  planning  process  DFAS  attempted  to  identify  costs  for  each  contingency 
plan  (not  each  contingency)  during  risk  assessment  phase.  We  quickly  found  costs  were  not 
included  in  most  assessments  and  for  those  assessments  with  estimated  costs  the  information 
was  usually  not  reliable  or  ver  generic.  We  explored  improving  the  cost  estimates  by 
standardizing  and  providing  criteria,  such  as  setting  the  parameters  and  defining  scope. 
However,  we  quickly  realized  the  infinite  number  of  contingency  situations  and  unknowns 
made  developing  reliable  cost  Information  almost  impossible.  Also,  developing  such  costs 
provided  little  added  value  for  DFAS  because  of  the  way  contingency  operations  have  been 
funded  in  the  past.  Historically  DoD,  including  DFAS,  does  not  fund  contingency  operations 
before  actual  costs  are  incurred.  Also  DFAS  operates  with  a  working  capitol  fund  rather  than 
appropriated  funds.  Most  of  DFAS’  contingency  costs  are  related  to  operational  costs  such 
as  salaries  and  overtime  father  than  purchasing  or  procurement  of  equipment.  Therefore, 
DFAS  incurs  the  cost  necessary  to  keep  it  in  operation  and  then  incorporates  increased  costs 
in  computing  future  billings  to  our  customers.  On  rare  occasions,  OUSD  ©  has  provided 
DFAS  with  additional  appropriated  funds  to  cover  contingency  operations,  but  this  is  after 
they  are  accrued.  Therefore,  it  was  determined  our  limited  resources  could  best  be  used 
elsewhere  in  the  planning  process. 

Note:  The  audit  report  on  page  5,  section  titled  Planning  for  Y2K  Contingencies  states, 
“Also,  the  DoD  Y2K  Management  Plan  requires  cost  estimates  to  be  developed  for  each 
contingency  and  information  on  contingencies  are  exchanged  with  systems  users  and 
managers  of  interfacing  systems.”  We  could  not  find  the  reference  to  the  cost 
requirements  in  the  DoD  Y2K  Management  Plan.  We  contacted  the  DoD  Y2K  office 
responsible  for  this  document  on  May  26,  1999.  Initially,  they  could  not  locate  the 
reference  and  over  the  phone  stated  they  agreed  it  was  not  a  practical  requirement, 

b.  Regarding  the  comment  “information  on  contingencies  be  exchanged  with  system  users  and 
managers  of  interfacing  systems”,  we  recognize  more  can  be  done.  However,  we  have 
accomplished  several  initiatives  and  many  more  are  underway  to  disseminate  information 
regarding  our  contingency  plans  to  our  critical  trading  partners  including  the  system  users 
and  managers  of  interfacing  systems.  This  includes  providing  presentations  on  our 
contingency  plans  to  most  of  the  military  services  and  DISA.  Also,  we  have  posted  to  our 
web  site  the  DFAS  overarching  contingency  plan,  which  lists  our  contingency  strategies  for 
Y2K.  We  continuously  encourage  the  business  mangers  and  system  managers  to  contact 
their  critical  trading  partners  and  exchange  information  regarding  contingency  plans.  We  are 
encouraging  business  managers  to  include  their  key  trading  partners  in  the  testing  of  their 
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contingency  plans  during  our  internal  live  testing,  as  well  as  during  CJCS  exercises.  We 
intend  to  make  a  special  effort  to  emphasize  to  our  mid  tier  system  managers  the  importance 
of  coordinating  and  providing  information  to  their  interfacing  partners. 

4.  Certifications  of  Systems  as  Y2K  Compliant.  The  statement  that  DFAS  was  not  planning  to 
certify  the  Defense  Business  Management  System  (DBMS)  and  that  the  system  would  move 
to  end-to-end  testing  without  being  certified  is  incorrect.  DBMS  was  certified  on  a 
compliant  platform  on  March  24, 1999. 

5.  Y2K  Certifications  in  DFAS  Managers*  Checklists  versus  DFAS  Y2K  Monthly  Status 
Report  The  DFAS  Y2K  Project  Officer  updates  the  certification  information  on  the  DFAS 
Y2K  report  after  she  has  reviewed  and  accepted  the  certification.  This  process  ensures  the 
accuracy  of  the  data  used  by  DoD  to  report  to  the  Office  of  Management  and  Budget.  The 
inconsistencies  that  existed  between  the  levels  of  Y2K  certification  shown  in  the  checklists 
completed  by  DFAS  managers  and  the  DFAS  Y2K  monthly  status  report  are  explained 
below. 

a.  Checklist  showed  DFAS  Level  2  and  Monthly  Report  showed  DFAS  Level  3. 

(1)  Several  DFAS  systems  tested  on  a  compliant  platform  and  certified  before  DFAS  Level 
3  was  established.  To  document  that  those  systems  were  truly  level  3,  a  special  one-page 
certification  was  added  to  the  existing  Level  2-certification  checklist.  The  Level  2  certifications 
for  the  Defense  Working  Capital  Accounting  System  (both  Defense  Automated  Printing  Service 
and  Public  Works  Centers),  Entitlement  Automation  System,  and  Prevalidation  Management 
Information  Reporting  System  fell  in  this  category. 

(2)  The  Military  Traffic  Management  Command-Financial  Management  System 
documentation  attaining  a  Level  2  certification  refers  to  the  DoD  Level  2  not  the  DFAS  Level  2. 
The  original  certification  was  done  at  a  DoD  Level  3  (self-certification)  and  was  redone  at  DoD 
Level  2  (Audited)  to  meet  the  requirement  for  Mission  Critical  system  to  be  certified  at  DoD 
Level  1  or  2. 

b.  Checklist  showed  different  alpha  level  (a  or  b)  than  the  monthly  report 

(1)  When  the  DFAS  Certification  Guidance  was  updated  to  include  the  new  levels  la,  lb, 
2a,  and  2b,  the  following  note  was  included:  “These  levels  are  based  on  the  DoD  Year  2000 
Management  Plan  For  Signature  Draft  Version  2.0.  Currently  the  letters  representing  the  size  of 
the  year  fields  are  inconsistent  since  “a”  represents  2-digit  years  for  levels  1  and  2  and  “b” 
represents  2-digit  years  for  level  3.  DFAS  has  requested  the  numbering  scheme  be  changed  so 
that  “a”  always  represents  4-digit  years  and  “b”  always  represents  2-digit  years.  If  the  levels  are 
changed  in  the  DoD  Year  2000  Management  Plan,  this  guidance  will  be  adjusted  to  comply  with 
the  change.”  The  final  Version  of  the  DoD  Year  2000  Management  Plan  did  reverse  the  levels; 
therefore,  the  letters  had  to  be  adjusted  for  any  DFAS  system  that  had  already  certified. 

c.  The  Industrial  Fund  Accounting  System  was  certified  at  a  DoD  Level  lb.  We  arc  unsure 
where  the  “3a”  came  from. 
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d.  The  audit  report  states  “The  DFAS  monthly  report  indicated  two  systems  operating  on 
mid-tier  computers  were  Y2K  compliant,  but,  were  not  certified  as  having  been  tested  on 
a  Y2K  compliant  mid-tier  computer.  Those  two  systems  were  the  Unmatched 
Disbursement  Reconciliation  System  and  the  Standard  Accounting  and  Reporting 
System.'1  Both  systems  were  tested  and  certified:  UDRS  on  March  24, 1999  and  STARS 
on  March  30, 1999. 

e.  The  1 0  systems  listed  under  the  title  “Mechanization  of  Contract  Administration  Services 
Subsystems”  are  not  subsystems  of  MOCAS.  The  title  should  be  changed  to  “MOCAS 
Interfacing  Systems”  and  the  6  interfacing  systems  should  either  be  indented  or  moved  to 
the  end  of  the  list  to  distinguish  them  from  the  remaining  systems. 

6,  Implementation  of  Mission-Critical  Systems.  The  Standard  Materiel  Accounting  System, 
which  was  the  only  mission  critical  system  that  had  not  been  implemented  at  the  time  of  the 
DoD  10  review,  was  implemented  on  May  20, 1999. 

a.  Of  the  four  non-mission  critical  systems  that  hadn't  been  implemented  at  the  time  of  the 
review,  two  have  been  implemented:  Computerized  Accounts  Payable  for  Windows 
(4/15/99)  and  Contract  Invoice  Service  (5/12/99).  The  mid-tier  piece  of  the  Departmental 
Financial  Reporting  and  Reconciliation  System  is  scheduled  for  replacement  by  July  31, 
1999.  The  Defense  Joint  Accounting  System  is  a  developmental  system  that  has  been 
implemented  at  a  prototype  site. 
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